Security Best Practices changeddocs/2025-03-26/tutorials/security/security_best_practices
Upstream edited this page at 28 Jul 2026 15:42 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 22 Oct 2026 20:37 UTC.
Upstream edited
Recorded here
Lines+4added
Lines−4removed
From line
8
where the diff opens
First seen
26 Aug 2026
this site's first read of the page
Recorded edits3to this page, all time
The whole hunk
from line 8, old and new numbered
/
from line 8
88
99This document provides security considerations for the Model Context
1010Protocol (MCP), complementing the
11[MCP Authorization](/specification/2025-03-26/basic/authorization)
11[MCP Authorization](/specification/2025-03-26/basic/authorization.md)
1212specification. This document identifies security risks, attack vectors,
1313and best practices specific to MCP implementations.
1414
from line 148
148148 consent screen
1491496. The MCP authorization code is redirected to the attacker's server
150150 (specified in the malicious `redirect_uri` parameter during
151 [dynamic client registration](/specification/2025-03-26/basic/authorization#dynamic-client-registration))
151 [dynamic client registration](/specification/2025-03-26/basic/authorization.md#dynamic-client-registration))
1521527. The attacker exchanges the stolen authorization code for access
153153 tokens for the MCP server without the user's explicit approval
1541548. The attacker now has access to the third-party API as the compromised
from line 284
284284#### Risks
285285
286286Token passthrough is explicitly forbidden in the
287[authorization specification](/specification/2025-03-26/basic/authorization)
287[authorization specification](/specification/2025-03-26/basic/authorization.md)
288288as it introduces a number of security risks, that include:
289289
290290* **Security Control Circumvention**
from line 538
5385382. The attacker obtains an existing session ID and sends a malicious
539539 event to **Server B** with said session ID.
540540 * When a server supports
541 [redelivery/resumable streams](/specification/2025-03-26/basic/transports#resumability-and-redelivery),
541 [redelivery/resumable streams](/specification/2025-03-26/basic/transports.md#resumability-and-redelivery),
542542 deliberately terminating the request before receiving the response
543543 could lead to it being resumed by the original client via the GET
544544 request for server sent events.
No line in this hunk matches that.